Breach Watch
Written for risk decisions, not headlines.
Breach, ransomware, vulnerability, advisory and threat intelligence, classified by a founding sponsor's threat intelligence service and analyzed in an ADTP brief for every item.
Showing 20 of 16,188
BREACH WATCH BRIEF
Maersk Confirms Legacy System Breach; Hackers Claim 100 GB Data Theft and $5 M Ransom Demand
Maersk disclosed an unauthorized intrusion into a legacy logistics platform, isolating the system while a ransomware group alleges theft of 100 GB of data and demands $5 million. The episode underscores the importance of strong access‑control and privileged‑account governance for audit readiness.
BREACH WATCH BRIEF
The global socket: how threat actors are weaponizing GSocket for stealthy C2
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect, investigate, and remediate this activity. The post The global socket: how threat actors are weaponizing GSocket for stealthy C2 appeared first on Microsoft Security Blog .
BREACH WATCH BRIEF
Microsoft FORGE Lab Discovers 33 New Linux Kernel CVEs, Including 8 Privilege‑Escalation Flaws
Microsoft’s FORGE Lab used AI‑assisted scanning to identify 33 new Linux kernel CVEs, eight of which have reproducible local‑root exploits. The findings highlight the need for robust vulnerability‑management controls to keep audit evidence up‑to‑date.
BREACH WATCH BRIEF
AI‑Generated Voice Deepfakes Enable $129 M Corporate Wire‑Transfer Fraud, Three Arrested
Three men used AI‑generated voice and video deepfakes to pose as executives and attorneys, convincing employees worldwide to wire over $129 million. The scheme highlights the need for updated identity‑verification controls and security‑awareness training to meet audit‑readiness requirements.
BREACH WATCH BRIEF
Token’s Internal AI Agent Violated Core Identity, Access, and Traceability Controls – Lessons for AI Governance
Token built a browser‑based AI agent that inherited a human user’s credentials, over‑privileged access, and shared logs, exposing gaps in AI‑agent identity and audit controls. The lesson underscores the need for distinct agent identities, least‑privilege permissions, and separate provenance to satisfy cross‑framework control objectives.
BREACH WATCH BRIEF
Rubrik Adds DevOps Cyber Recovery to Guard Against Credential‑Compromised Code Attacks
Rubrik announced DevOps Protection for Azure DevOps and GitHub, adding anomaly detection, blast‑radius investigation, and surgical recovery to mitigate credential‑driven code attacks. The capabilities map to identity‑access controls and help organizations demonstrate audit‑ready evidence of rapid remediation.
BREACH WATCH BRIEF
eMudhra Revokes Eight Intermediate CAs After Internal Script Exposes Private Keys
eMudhra disclosed that a Python automation script inadvertently logged the private keys of eight intermediate certificate authorities, leading to their revocation. The exposure underscores the importance of robust cryptographic key‑management controls for audit readiness.
BREACH WATCH BRIEF
Microsoft Releases November 2026 Update to Fix USB Audio Failures Introduced by September Security Patches
September 2026 Windows security updates broke USB Audio Class 1.0 devices, causing loss of sound and Code 10 errors. Microsoft resolved the issue with the November 2026 cumulative update (KB 5132061). The incident underscores the importance of rigorous patch‑management controls for audit readiness.
BREACH WATCH BRIEF
Microsoft Researchers Reveal ‘Lazarus’ Weight‑Space Backdoor Technique for AI Agents
Microsoft’s research team demonstrated a method to embed a hidden backdoor into AI agents by tweaking a handful of dormant neurons, allowing malicious commands to be triggered later. The finding highlights a model‑integrity risk for enterprises that give AI agents privileged access, underscoring the need for provenance checks and strict governance.
BREACH WATCH BRIEF
CISA Flags Actively‑Exploited Cisco BroadWorks XXE Flaw (CVE‑2026‑20320)
CISA added Cisco BroadWorks CVE‑2026‑20320 to its KEV catalog after confirming active exploitation that lets unauthenticated attackers read private keys. The flaw highlights the need for rapid patching and robust vulnerability‑management controls for audit readiness.
BREACH WATCH BRIEF
Ubuntu 26.10 Adds Built‑In Certificate Revocation Checks to curl, OpenSSL Integration Planned
Ubuntu 26.10 ships curl with native certificate‑revocation verification via the upki package, rejecting revoked TLS certificates that earlier releases accepted. The change closes a long‑standing gap in non‑browser tools and paves the way for OS‑wide revocation checks once integrated into OpenSSL in Ubuntu 27.04, a key control for cryptographic trust management.
BREACH WATCH BRIEF
Druva Launches AI‑Agent‑Level Backup & Recovery to Avoid Full‑Environment Restores
Druva unveiled Agent Recovery, enabling immutable, per‑agent backups for Microsoft Copilot Studio, Power Apps and Power Automate. The feature gives enterprises evidence that critical AI workloads are protected, supporting audit‑ready backup and recovery controls.
BREACH WATCH BRIEF
Fingerprint Launches Fraud Score – Tailored ML Models for Distinct Fraud Types
Fingerprint introduced Fraud Score, a service that trains separate machine‑learning models on each customer’s fraud outcomes and device‑intelligence signals, delivering higher detection rates without extra false positives. The offering underscores the importance of AI/ML model governance for audit readiness.
BREACH WATCH BRIEF
Microsoft Patch Update Breaks On-Prem Exchange Sign‑Ins, Fixed with November 2026 Cumulative Update
Microsoft’s October 2026 Windows Server updates introduced a memory‑limit change that stopped Outlook on the web sign‑ins and mail flow for on‑prem Exchange servers. The issue was resolved with the November 2026 cumulative updates, underscoring the importance of change‑management controls for audit readiness.
BREACH WATCH BRIEF
Orca Security Expands Cloud Visibility to AI‑Generated Apps and Autonomous Agents
Orca Security introduced AI AppGen capabilities that automatically discover AI‑generated applications and coding agents across cloud environments, providing evidence for AI governance controls. This matters because it supplies the audit‑ready visibility needed to manage AI‑related risk under emerging governance frameworks.
BREACH WATCH BRIEF
Obsidian Launches Runtime Policy Decision Engine to Govern AI Agent Actions Across SaaS Platforms
Obsidian Security unveiled a Runtime Policy Decision Engine that enforces centralized, real‑time policies on AI agents across development tools and SaaS applications. The capability provides auditable control over agent actions, supporting AI governance frameworks such as NIST AI RMF.
BREACH WATCH BRIEF
Microsoft Releases Patches for 1,259 Flaws, Including Outlook Exploit That Can Leak NTLMv2 Hashes
Microsoft’s October 2026 Patch Tuesday fixed 1,259 vulnerabilities across Windows, Office, SQL Server and more, with a highlighted Outlook bug that attackers can use to capture NTLMv2 hashes. The breadth of the patch set underscores the need for robust vulnerability‑management controls to sustain audit readiness.
BREACH WATCH BRIEF
Railway PaaS Reports Theft of Customer AI API Keys Resulting in $740K Unauthorized Usage
Railway disclosed that attackers stole API keys stored for AI services and generated $740,000 in unauthorized usage. The breach underscores the need for robust secret‑management and access‑control controls to satisfy audit‑readiness across frameworks.
BREACH WATCH BRIEF
YouHack Forum Breach Exposes 7.2 Million Email‑Password Pairs from 2013 Compromise
The Russian‑language hacking forum YouHack was breached in May 2013, leaking 7.2 M email addresses with unsalted MD5 password hashes. The exposure highlights the importance of strong credential storage and MFA for audit readiness.
BREACH WATCH BRIEF
Microsoft Researchers Demonstrate Backdoor Injection into AI Agents by Tweaking Fewer Than 10 Neurons
Microsoft researchers have shown that altering fewer than ten rarely used neurons in a large‑language model can embed a hidden backdoor that activates on a trigger phrase, allowing an attacker to execute commands with the AI agent's permissions. The finding highlights the need for AI model integrity controls and governance to satisfy audit and compliance requirements.
Breach Watch intelligence is provided by a founding sponsor of the Association. Every ADTP brief carries the sponsor's analysis and links the original source.
Practitioner briefings
Written by the association: what the week's intelligence means for the controls you run.
Reading a vendor's breach notice for what it does not say
A practitioner checklist for turning a supplier notification into an evidence request and a monitoring change.
Where AI inventory efforts stall, and the control that unblocks them
Findings from practitioner roundtables on AI governance programs in their first year.
Evidence reuse across customer diligence and audit
How practitioners are organizing one evidence base to serve buyers and auditors at the same time.
Global Privacy Control signals and state opt-out obligations
What a site must do when it sees a GPC signal, and how to evidence it.
Get the digest
No membership required. Confirm by email; unsubscribe in one click.